Overview

overview

10

Static

static

8102623e6f...ff.exe

windows7_x64

10

8102623e6f...ff.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8102623e6f4d3c4dcc26b594360b19c79f80c64c50102c141941dd8b5654a3ff

  • Size

    511KB

  • Sample

    220609-qjdbascgf4

  • MD5

    1733079217ac6b8f1699b91abfb5d578

  • SHA1

    b954840e40ea3a9036a2c0379aab8f06df3a1d45

  • SHA256

    8102623e6f4d3c4dcc26b594360b19c79f80c64c50102c141941dd8b5654a3ff

  • SHA512

    60e4d7115a5ea18dee219c267c2ddbec7c31912cf0bb9a5622d20311a211788783fad2ee5e457c07b2fbd81d2fdaff48e2156556a7dcb321832c080ba4a70cc1

Score
10/10
imminentagilenetpersistencespywaretrojan

Malware Config

Targets

    • Target

      8102623e6f4d3c4dcc26b594360b19c79f80c64c50102c141941dd8b5654a3ff

    • Size

      511KB

    • MD5

      1733079217ac6b8f1699b91abfb5d578

    • SHA1

      b954840e40ea3a9036a2c0379aab8f06df3a1d45

    • SHA256

      8102623e6f4d3c4dcc26b594360b19c79f80c64c50102c141941dd8b5654a3ff

    • SHA512

      60e4d7115a5ea18dee219c267c2ddbec7c31912cf0bb9a5622d20311a211788783fad2ee5e457c07b2fbd81d2fdaff48e2156556a7dcb321832c080ba4a70cc1

    Score
    10/10
    imminentagilenetpersistencespywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks